CVE-2026-0300: PAN-OS User-ID Authentication Portal buffer overflow allows root code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityUnauthenticated remote root code execution on perimeter firewalls, listed in CISA KEV with a near-term remediation due date and high EPSS score.

What it is

A buffer overflow (out-of-bounds write, CWE-787) in the User-ID Authentication Portal (Captive Portal) service of Palo Alto Networks PAN-OS lets an unauthenticated attacker execute arbitrary code with root privileges on PA-Series and VM-Series firewalls by sending crafted packets. Because the flaw is remotely reachable without credentials and yields root, it is a severe pre-authentication firewall compromise vector. Prisma Access, Cloud NGFW and Panorama are not affected.

Impact

An unauthenticated attacker can run arbitrary code as root on the firewall, giving full control of the device, its configuration and the traffic it inspects. That can enable interception, policy manipulation or use of the firewall as a pivot into protected networks.

Attack surface

Reachable over the network via the User-ID Authentication Portal service; the CVSS 4.0 vector shows AV:N/PR:N/UI:N, so no authentication and no user interaction are required. Exposure is greatly reduced when portal access is restricted to trusted internal IP addresses per vendor best practice.

Exploitation

CVE-2026-0300 is listed in CISA KEV (added 2026-05-06, due 2026-05-09), indicating known exploitation, and EPSS gives a 30-day probability of 0.317 (98th percentile). No ransomware campaign use is documented in the record.

What to do

• Apply the PAN-OS patches Palo Alto released (referenced in the KEV required action dated 5/13/2026) as the first step.
• Until patched, restrict User-ID Authentication Portal access to only trusted internal IP addresses and trusted zones per vendor guidance.
• Disable the User-ID Authentication Portal entirely if it is not required.
• Follow BOD 22-01 guidance for cloud services or discontinue use of the product where mitigations are unavailable.
• Review Siemens RUGGEDCOM APE1808 exposure (listed as an affected product) against the Siemens advisory SSA-967325.

Detection

• Monitor firewall and portal logs for malformed or unusually large packets directed at the User-ID Authentication Portal service.
• Alert on unexpected process activity, crashes or restarts of the Captive Portal service on PA-Series and VM-Series firewalls.
• Audit portal exposure: flag any firewall where the User-ID Authentication Portal is reachable from untrusted zones or the internet.
• Hunt for post-exploitation signs such as unexpected configuration changes, new admin accounts or outbound connections from the firewall management plane.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.